CVE-2026-76083

The Redash data visualization package is vulnerable in versions 10.0.0 through 26.9.0 . The JSON data source query runner (specifically in redash/query_runner/json_ds.py) improperly uses urljoin to combine a configured base_url with a user-supplied query URL. Because an absolute query URL can rep...

CVE-2026-76083

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

EUVD-2026-101516

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...

CVE-2026-76083: Server-Side Request Forgery (SSRF)

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured...